Google Chrome EUVD-2026-50753

Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (a prerequisite second-stage condition explicitly stated in the description) and then delivers a crafted HTML page that exercises the vulnerable Media code path; CVSS UI:R indicates the victim must interact by loading attacker-controlled content. The chief LIMITING factors are: the mandatory pre-existing renderer compromise (this is a sandbox-escape primitive, not a standalone entry point), required user interaction, and applicability only to Chrome desktop builds below 151.0.7922.72. Note the CVSS PR:N does not reflect the renderer-compromise prerequisite - verify scope with the vendor advisory rather than treating this as unauthenticated single-shot RCE.

The raw CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C, full C/I/A impact) looks critical, but the CVSS PR:N conflicts with the description, which explicitly requires an attacker who 'had compromised the renderer process' - meaning this is a second-stage sandbox-escape primitive, not a standalone unauthenticated RCE. This discrepancy should be flagged: PR:N does not capture the prerequisite renderer compromise, so real-world risk is gated by chaining with a separate renderer bug. Supporting signals reinforce a moderate practical priority: EPSS is low (0.21%, 11th percentile), Chromium's own severity rating is Medium, it is NOT in CISA KEV, and no public exploit is identified. Together these indicate a serious-but-conditional issue typical of Chrome sandbox-escape components rather than a mass-exploited, drive-by network flaw. Prompt patching is still warranted given browser ubiquity and Chrome's history of UAF chains being weaponized.

An attacker first exploits a separate renderer-level vulnerability (e.g., via a malicious or compromised website) to gain code execution inside Chrome's sandboxed renderer. They then serve a crafted HTML page that triggers the use-after-free in the Media component to corrupt memory and escape the sandbox, gaining higher-privileged code execution on the host. No public exploit is identified at time of analysis, and success requires user interaction (visiting the page) plus a chained renderer compromise.